Automated security analytics platform with pluggable data collection and analysis modules
AssigneeClick Security, Inc.
InventorsBrian Smith, Donovan Kolbly, Marc Willebeek-LeMair
Life of this patent
Estimating the term…
Abstract
Pluggable network security modules provide a collaborative response across plural networks by allowing modules associated with detection and neutralization of a network security threat to plug into a network security platform of other networks. Plugging the security modules in provides an automated insertion of detection and neutralization tools into the network security platform to respond to potential threats based upon proven successful responses at other networks.
Claims20
A method for maintaining network security, the method comprising:
- distributing a network security platform to each of plural networks, each network security platform having a sensor execution environment and an analysis execution environment;
- monitoring network activity for each of the plural networks with plural sensor modules running on the sensor execution environment of each of the plural network security platforms, the plural sensor modules storing monitored network activity in memory accessible by the analysis execution environment;
- detecting a network threat with one or more of plural analysis modules running on the analysis execution environment of one of the network security platforms, the detecting performed by analysis of the stored monitored network activity at the one network security platform;
- and
- in response to detecting the network threat, distributing the one or more of plural analysis modules to the analysis execution environment of one or more other of the network security platforms.
A system for maintaining network security, the system comprising:
- a processor operable to process information, the processor having integrated program memory;
- an active memory interfaced with the processor, the active memory storing network telemetry information accessible by the processor;
- a sensor execution environment defined in the processor and operable to run plural sensor modules that store network telemetry information to the active memory;
- an analysis execution environment defined in the processor and operable to run plural analysis modules that analysis network telemetry information for network security threats;
- wherein the plural sensor modules are further operable to store network telemetry information in a sensor table of the analysis execution environment and wherein at least one of the plural analysis modules have one or more bindings that selectively respond to network telemetry information as the sensor module stores the network telemetry information in the sensor table.
A machine readable medium comprising instructions operable to execute on a network security analysis execution environment to:
- one or more tables, each table having plural rows, each row providing a structured record mapping names to network sensor values according to a schema;
- one or more bindings having handlers associated with tables for responding to a network security event entered at the one or more tables;
- native code operable to reside in program memory of a processor for responding to the network security event;
- and
- an interface operable to load the native code to the processor, native code responding in real time to network security events indicated by entries to one or more of the tables.
Dependencies are inferred from the claim text.